pfsense runs in a vm on proxmox, can that be a problem with the linux bridge proxmox uses? I did a second setup with pfsense in NAT mode and a local IP address on the LAN side, same problem with outbound connection. I can only ping. EDIT: Found the solution: disable "Hardware Checksum Offloading" for Proxmox VirtIO interface

This is my test : [image: 1545093182755-3gbit-iperf-resized.png] I run pfSense on Cisco UCS C210 M2 with 2x X5650 CPU and BroadCom QLogic dual port 10G NIC... Maximum load I registered was 11%... I am pretty sure this result is caused by a speed limitations between me and server instead of my pfSense box... After a few day I will have second 10G line from separate ISP and then I can test again... This machine was released in 2010 so almost 9 years old but works pretty well and I am happy with it ;)

Yes, it looks to me like your Asus router has started handing out DHCP leases in conflict with pfSense. Make sure it is running the same settings it was previosuly. But, yes, it would be far better to use separate devices as the DSL modem and wifi access point. You're relying on PPPoE to separate WAN from LAN there. Steve

Nice. Realtek NICs are better than they used to be but there's a reason they still have a bad rep. Steve

It's there because the interface is always there, and there isn't a good way to track that it was never enabled. If it's disabled now, there could still be some historical data there that someone might want to see if IPsec was recently or temporarily disabled.

@netblues Actually updated to 2.4.4_1 (or 2.4.4p1 as it says in your thread) and it took care of all of it. Thank you for that first reply you made my search 100% more successful :)

I think I know what it is- proxy ARP on another router causes this problem. Testing it now. I still don't understand why it affects only pfsense.

@johnpoz said in latency of connection monitoring: Great then ping those - what is the latency.. sorry for the few hours hiatus. I did ping the above, however packets may be dropped as no ping back is received. I heard most game providers do that, probably to lessen the load on servers that i assume may be running at close to full capacity, and, in a conspiracy theory view.... to hide the fact that servers used may be in a different region or may not be as good as players expect them to be.. LOL. The first reason much more likely. On PC, the game seems to run better and faster, plus ping is readily available and can be added as an overlay on a corner of the screen, but this is a whole different world.

VLAN 101 is usually required, for residential connections at least. If you're using one of the Openreach modems they are configured to add that. If you're using some other modem such as in this case you need to add it either at the modem or in pfSense if the modem passes that. Steve

It's probably connections coming in faster than HAProxy can service them. Once the queue values is exhausted it starts throwing that error. You can increase that value quite substantially without a problem but it may just delay the problem. Set a system tunable kern.ipc.soacceptqueue to something larger that the default 128. Try 512. See if that eliminates the error or simply delays it's appearance. Steve

NAT+Proxy sets up a service like that for each instance and it appears that one was having some issue. Perhaps the IP you have it running on has been removed or the interface was down. Running in Pure NAT mode is preferred as it doesn't require such a service. There are very few situation that actually require NAT+Proxy. Setting the NAT reflection type individually for each forward is the best way to avoid something like that though as you have done. Steve

I tried that in the beginning no change. I have noticed that under the interface status I do get the ip address but the gateway shows pending.

the usb keyboard does work on this computer but when i plug it into the other one it does characters. i plugged in my ps/2(yes i still have ps/2 kb and mouse) it does not show those characters, so you are right it was the keyboard. thank you for replying. i thought the keyboard was fine but I guess not.

@kom kill me!

Windows boxes out of the box are going to be Noisy little bastards.. And even if your not using IPv6 are going to put a lot of NOISE on the network via ipv6 You have a few options Just ignore it and live with the log spam Set firewall not to log the noise Configure your client boxes to not send out so much ipv6 noise when your not using ipv6 - with windows easy way is to just disable it.. Take a look here for what option best suites your needs. https://support.microsoft.com/en-us/help/929852/guidance-for-configuring-ipv6-in-windows-for-advanced-users

Yes, we do that here. There is some manual work to be done, but see https://github.com/opoplawski/ansible-pfsense/tree/master/roles/pfsense_setup for basically how we do it. I think I still need to figure out how to start nslcd automatically after reboot. /etc/rc.conf.local I thought used to do it, but perhaps not anymore with 2.4.4.

No Not ideally, maybe if you have an ACME/LE trusted cert but even then I would not recommend treating your firewall as a general purpose web server.